Creating a mailbox in cPanel takes about thirty seconds. The decisions worth thinking about are the quota you give it and whether the address should be a mailbox at all. A forwarder is often the better answer and costs nothing.
Creating one
In cPanel, open Email Accounts and choose Create.
Domain and username. Pick the domain if the account holds several, then the part before the @.
Password. Use the generator. Mail accounts are attacked constantly by automated login attempts, and a weak one that succeeds is not just a compromised mailbox; it becomes a spam relay, which gets the server's IP address blocklisted and affects everyone else on it.
Storage quota. The default is often generous. Set it deliberately, because mailbox quotas are how one address quietly consumes the whole account's disk.
Create it, and the mailbox works immediately. Nothing propagates and nothing needs restarting.
Quotas are the setting that matters
Mail counts against your account's total disk allocation. A single mailbox left unlimited, collecting everything since 2019 with large attachments, will fill the account, and a full account cannot write anything.
What the client experiences at that point is not a mail problem. Incoming mail is rejected, uploads fail, database writes are refused, forms break. Several unrelated symptoms with one cause, and none of them mention disk.
So give each mailbox a number. A few gigabytes suits most people; a shared address receiving attachments needs more. Whatever you choose, the sum of your mailboxes should fit inside your allocation with room left for the website.
Consider a forwarder instead
Before creating a mailbox, ask whether anyone will actually log into it.
Addresses like info@, sales@, support@ and contact@ are usually better as forwarders pointing at a mailbox someone already reads. A forwarder uses no storage, has no password to be compromised, and needs no configuration in anyone's mail client.
Four mailboxes nobody checks is four sets of credentials to protect and four folders quietly filling with spam. Setting up email forwarders covers the alternative.
Create a mailbox when someone will genuinely use it, and a forwarder for everything else.
Connecting to it
cPanel's Connect Devices link on each account shows the exact settings, and they are worth taking from there rather than guessing.
Use the secure ports:
Incoming (IMAP) 993, SSL/TLS Incoming (POP3) 995, SSL/TLS Outgoing (SMTP) 465 SSL, or 587 STARTTLS Username the full address, [email protected]
Two things trip people up. The username is the whole address, not just the part before the @: entering only the first part rejects a correct password. And outgoing authentication must be enabled in the client; many default it to off, which produces a relay-denied error that reads like a permissions problem.
IMAP, not POP3
IMAP keeps mail on the server and syncs across devices, so a message read on your phone shows as read on your laptop.
POP3 downloads and typically removes mail from the server. It exists for a world where storage was expensive, and choosing it today usually ends with someone's mail existing only on one laptop.
Use IMAP unless you have a specific reason. Note that IMAP means mail stays on the server, which is exactly why the quota matters.
Webmail
Every mailbox is reachable at:
https://yourdomain.com/webmail
Useful for checking mail from a machine that is not yours, and as a diagnostic: if a message appears in webmail but not in your client, the server is fine and the client configuration is wrong. That single test narrows most email problems immediately.
Changing and deleting
Passwords and quotas are changed from the Email Accounts list at any time. Changing a password disconnects clients until they are updated, which is expected.
Deleting a mailbox deletes its stored mail. There is no trash and no recovery beyond your own backups. If someone is leaving, take a copy of the mailbox first, or convert the address to a forwarder pointing at whoever takes over. That keeps the address working for anyone who still writes to it.
Deleting a mailbox while a forwarder still points at it produces bounces for mail sent to that forwarder, which is a confusing symptom to trace back to a deletion weeks earlier.
Before mail can arrive at all
Two things have to be true, and both live outside this screen.
The domain's MX records must point at this server. If mail is handled elsewhere, mailboxes here receive nothing regardless of how correctly they are configured.
And for your outgoing mail to be trusted, SPF, DKIM and DMARC need to be published: without them major providers treat your mail as suspect. Understanding SPF, DKIM and DMARC explains it, and it is worth doing before you tell anyone the address exists.
Before handing the settings to anyone, decide which protocol they should use. There is more on where the mail ends up in each case in IMAP vs POP: Which Should You Use.
On a domain with nothing set up yet, a few decisions are worth making before the first mailbox. How to Set Up Email for a New Business Domain has the detail.
The same mailbox can also serve calendars and contacts to your devices. How to Set Up Calendars and Contacts in cPanel deals with switching it on.
